CVE-2026-67918

Published: Ago 18, 2026 Last Modified: Ago 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint

https://github.com/luoxuanxi/cve/tree/main/cve-hermes-studi…
https://github.com/luoxuanxi/cve/tree/main/cve-hermes-studio-afr